d544d98ad1fbc75bc7a26f4377468d1eb12513f5c6ee7b7e0b54a2a83cf60c52

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 02:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e186e636e9ad0ba9553796d72484e0d8_JaffaCakes118.html
Size

52KB
MD5

e186e636e9ad0ba9553796d72484e0d8
SHA1

2b61f4849e3e02596b1534f3f7e4d709b2b08906
SHA256

d544d98ad1fbc75bc7a26f4377468d1eb12513f5c6ee7b7e0b54a2a83cf60c52
SHA512

a38a010400c0c5f0f6cbd3e46e4b7bfb7efcf381eaca339840b4ae5d62ec55c9fe5ab75d72dbc9809782d9c702b641b51b14f6a0fad50f6f6dd3c05b4e7ca90e
SSDEEP

384:RfLHA+oTd7qIBMWBMRq/qePjBUjrl9TqW2bowRus1shbfa5dcPnSIwsXRsYRilR4:RuDCWCGBirl9TWbyvb9ZiOpb5xKPVxGd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000018a05035b813972c3808ea710f4d65c3305df29917dbe19bd78b20db7c2d98ca000000000e8000000002000020000000329e15bdd223210e511435c33a8f0dd7cb5e9a7b6a843dfadaf3d9fbde4d6e1890000000eee39f225313ae7127bcd570b90ef0b74d62ba130750510c04a4da24b728c0539401d49252a827b4a3440fde382e6804722eb72e3301ba2bdd104e3a1048161f1c6ad65ca3b050797092a69c4d74ae55e420466df0c8a445b3bafcc1fd4e98c43fad91cee5dca9535b2ed965828d6678b9859ef3548bab79339b7ea8ba94c6246acd77e9d72ae841179d8d37aa42046a400000000eb57989053fbe05e30aabe196456d243e9e66d2303f411970cdd8071b04abf5904901e10231a0a381b5718af03d836947a41f0687e61f3a9cb0ba1ffab2853a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000f7e65aeb13e06516fb3d47256438561d5571af8a6c8955758c49d97f6bb2e0dc000000000e80000000020000200000006a525000b48b06a5899c6f824ea84f782d90236602ed1b663f0a8fe8d723004420000000f9649d421a2a4f5c803fcbe9c5316a10c25c6e58a1d619688cb70802138d36b04000000060c44dacefda64c6cc975425e2661a71496f99532c9dd1ae22389420d51098abd5d5926d6f006e69a09fcfcb4f77f88d66bd18ff5893c138f718ca5283776674	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3EB5F4D1-730A-11EF-A7B5-EAF82BEC9AF0} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432529201"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 804050491707db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1044	2220	iexplore.exe	30
PID 2220 wrote to memory of 1044	2220	iexplore.exe	30
PID 2220 wrote to memory of 1044	2220	iexplore.exe	30
PID 2220 wrote to memory of 1044	2220	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e186e636e9ad0ba9553796d72484e0d8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a32cc2fe114856b68c46737a71cb5edd

SHA1
b70ef78baa2fecb325552271a0f1c4862f815260

SHA256
79e08f3735156caa0377ac73247cdaeb0d1c60cf25f69e66186c571c75b1c69d

SHA512
3a2f3498cc491bf55d29ef457b700f1653b2ffb1ef3a5e1827046a743d2b1d97a04f549b1da26ebb766891ced102b4a7f78e9842afd9eb9cbbd8263ba88a1fb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ef7b92cebb03f5930c8cb10ea79d7d5

SHA1
7129717646a33906c5f091f7b0245de78899403a

SHA256
5837715bf4e723cd1731f18b48b16ece8ff68b0140fdcbd1302433c9cdf8f62f

SHA512
0696e49582b581e576263af8e29131147f4e739d1715fee2e6a22eb4da739a4b480b716b758e335b67c8f71889da3724fc79a967811cdbe751ca4314ff9f91b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1b187e8e7974693c1e83b6944824b7b

SHA1
8f6ee9c752ccf2076613ef6d148efa7233b18f45

SHA256
b715f42bac74ca8c62882be3915caa09f92b3e41ea47e36fb8199652f2102e03

SHA512
ad3baebc82ff8f3a0ac10a4023094a2c893a1db5ba560c6b824c0d57e4d74ae5cc89ebc4bd24f382644f7945002e55abceec4d5bcba5e98318bf969e2e99b3f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64ff1e232835327b74b83577e9b5fa6f

SHA1
d329599f6ad2b8e7ac2d9c584aaa4fbb0958e619

SHA256
3e7f27f1cdea0f3f9ffdd237a1d34079352d527b30fa8bc688866267fb64bf65

SHA512
405b5ba7dce7ee06c10fcfaa30ebc83c4dca57e3956fa58f72d29c33b58be51a284d468e2373c93c04f3df1b74be5ef95da2a12c09925c3ebd12f93efdbd3d14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00cc5a70fb6c031050ed2429ce16d3b8

SHA1
e3781a8e84a809dfcc6f7ac923888188cec382bb

SHA256
fac7c8c3bd9c13e2a6ed9af436435978550f90931cc0771e4f55779a7ba1baa3

SHA512
358baf167adb73bf5888ce9ef628a2fc87d6c7f98ec0dca578b89950495df414370e841818b760423c2ead205462401dcfa92b8ab0985a8e9ffc0379ecdb114c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4440f61a2c8692a2ac16619c32c7e7c

SHA1
9ec08e4a695e70b09024cf85cb3f5532826a8282

SHA256
443a79903ceca74d83b83013c845776578ac42f5f4594af8f3f27214a1773268

SHA512
2b19134001ac835d3a85be58af21059a6e9bcdc4a8b2dcbed8066f1f4c6474d5cebf5fedee9266d8ade2bd6482c6f336e54a3f9cb7286dd08761eb62e9e94448

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f25cec9e8eff9a2f67a1d016ec2154e

SHA1
36de711f072a8bc8983f1fe365d4bdb87234d5ad

SHA256
d6dce02dbe7fed0c911e181d3552c69f197f5a6edabc4f58c12626b3d3b9452c

SHA512
0a7740835cf3775dc7414e0359d19f60e94ac1cd325691f2119e9fa2e91a78cd5906929db9fa748e15e2395ce109bbe7d474b160dfb7ba8e6ac88b5eb59d9568

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2123e3f7cd6650083b672358416a646

SHA1
51c5d918ff634926f215cdc06430ab85b986af0d

SHA256
0ef13e409054ceafd12364d9012cdfd88d91242cc8569ada22c57d5d7fa0af41

SHA512
41cac0b2f2c5f29e7531d92beab588b84ccf09913d4a394e7f9bbf72d28fa9bcf3212f6224025e4fe0e4b743e9c09b097440950b41a56b3c241427270d173ab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d5fcd4a91b6d7900f2153d8f17fb0fc

SHA1
5b20af0289129310a397430b7802afb517290a94

SHA256
a85f0158345435d395006eb1d42f2bfc408bb62f666f783c2a3c0b529430751b

SHA512
5d22bfb34b8b99ad3c7f15a89deb7615aed0954fe8563428531f72612e9341e9b98d9b262d6b3892df9b29d078fbfdd4e4977d30bba0097fe691df2597f527b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffa41c124049831fc757cd8c89302303

SHA1
1b6ba6a80cd6aaf2007b89557022f45b49392db5

SHA256
b155267ae897fc30193b69c58841f0b0ca8c5948f9e89eaf04236cf98fc81819

SHA512
f05993026d16bfd29e17e90e08ab4aa63f993c4af18caf6817ccb6e80766e2352f5a400f08896c666e8b36f18389105f3c2bf03b9eb501d2a5502033465180ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67c839518214f3b6d85a2843bf5ad0e2

SHA1
1b7b822b68374f46fcae818aa6cd623a5c8e1cb8

SHA256
39cc4dd520b914efe759c6f15a547736a43a7ba7583701be99ea77f634ec1f02

SHA512
510dd5b86e39d883bda5cfbf9a3330c909e1b89707c87b2605d05c629b9db6fb7d9d472fbe7eb70748d15f5f8a89e2d4e500662e87945e6418db06ea3d1789cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29f5381a783a7e7ba5800d32b49d6c71

SHA1
60178e433a2c5d2146f386ec5b921d871e0140a5

SHA256
23758ad3bf1628d417404250f58860f853b0afc6650ac41f7b62c92de138cd51

SHA512
7dc90b7a3fe97ea9dcd9f20e4e202d0c2e56a7411f86da0980c10cf962aa5de1230ae4932cab45b9c660a17c2ee6ec1f5bc12e897cbca002a8bfb08f9b0d2c39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b18507a5ef65f0ac575d416b33393b52

SHA1
9aaad93eed30290ee69cdffe1ddecb1367d5009f

SHA256
0118cbd01060493f9341aaf765a69b0dec17dad61963eb300ac00bdf816ff814

SHA512
ab561eb0618c81a2b79a89f20ac0f741b80f34756350ef19871d588b0bb65a7095c67a48ba129575b7f3a0f2b24e983ef953ea7631f57dc3449587a2d366a2d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0aa63140708c0e056b1beb4765276932

SHA1
4022c45a7964cd86af7bafd40b4ae4b71a4a3288

SHA256
79573ef64c9dd988697f51c6ed64fd53544a499173e00751a6e81c8bca7f2eda

SHA512
3dab5ce6c7c34124f0919797de1346b7d4fd9cd8696363627868b12533eddae137c88f7dd255844f9ef3de1c06a713097db66ee18c16b9a9021e99ccadf18787

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2291a7d0cbada4156ccc9a506eb458f3

SHA1
8f860496c3ff825b5a7b8f6ea70626279aaa61a9

SHA256
2ec56bf919dec52ac10f7f7393d6d19b787f8da2a8335c703907db8f19addd09

SHA512
9fb52f893ee2d9e0907b5438d860f5fd52a77f86c22787e0549cd03d61025864357525bd7395df4716926e6ddb9fa8536010f4f576a37d5847c9500fca5f63ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6012a7c3b29af838f7f3d88dcff1a77f

SHA1
ce5ecd3f12ee9beae3492acbbbc6db28e2106b88

SHA256
f1b786fc7ca6c82841843ec0eb5b767057bdc7fe494fd9dd2add29ee5f0157f7

SHA512
2b59720cb543fb7b25c341eaea31a1a4b2ee7243d5330153e15424480233c4e1849ff5400bcdc1df9a201125a11674cb8839a7faf3c711af660fe84482fd525b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8C3A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8D08.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit